Cli-microsoft365: Bug report: 403 forbidden on Flow Export

[m-carter1]

Description

When running m365 flow export --environment [env] --id [id] I get the error "Error: Request failed with status code 403"

Running the command with --format json does work however.

If I grab the access token and run the command in postman I get same error but with more information:

{"error":{"code":"AuthorizationFailed","message":"The client certificate 'DF4D2C02B7F733BB44849D827A5BC6AFA11B316C' is not allowed."}}

Steps to reproduce

Export a flow with

m365 flow export --environment [env] --id [id]

Expected result

Success with a zip exported

Actual result

403

Environment

windows 10
m365 version: v3.4.0
node.js v14.15.4

[garrytrinder]

Thank you for raising this @m-carter1 apologies for the trouble, we will take a look ASAP.

[garrytrinder]

Can I ask whether this is the first time you have used the command or has this just stopped working for you?

[m-carter1]

This is the first time I've used it so it may be something I'm doing wrong but I was able to successfully get the flow json back just not the zip file. I get the same results on another tenant also.

[appieschot]

When prepping my pnp demo I had the exact same issue for 15 out of the 20 flows I wanted to export. The weird thing is that it did work 15m later for some of those 15 that first failed.. Could it be that MSGraph has perf. degredation?

[waldekmastykarz]

@m-carter1 before we start investigating it, could you please check if you can still repro the issue?

[m-carter1]

@m-carter1 before we start investigating it, could you please check if you can still repro the issue?

@waldekmastykarz yes still getting the 403 issue this morning

I'm authenticating using m365 login and then using the device code in a browser I assume that's correct and I'm not missing anything?

[waldekmastykarz]

That is correct. Are you the owner of the flow that you're trying to export? Can you open it in the browser?

[m-carter1]

Yes I am the owner and I'm able to open it in the browser.
The export works when setting --format=json but without that it's a 403 error

[waldekmastykarz]

@appieschot does that sounds like anything you've see in the past few days?

[waldekmastykarz]

@m-carter1 do you get this issue on all or some flows?

[m-carter1]

@waldekmastykarz yes all of them, I've just tried creating a new flow and same issue with that one too

[erwinvanhunen]

@waldekmastykarz We're seeing the same issues in PnP PowerShell, which is calling exactly the same end points.

[appieschot]

I have the same issue on all flows on my dev tenant :(

[waldekmastykarz]

Is the option in the UI available or gone? Could it be that the functionality has been removed from the service?

[m-carter1]

@waldekmastykarz I am still able to export flows as a zip from the UI

[waldekmastykarz]

Seems like there were some changes in the underlying API. Let's see if we can adjust the command to accommodate the changes.

[waldekmastykarz]

@m-carter1 we've just released a new preview version where this issue should be fixed. Could you please give it a try by running npm i -g @pnp/cli-microsoft365@next?

Once again thank you for reporting the issue! 👏

[m-carter1]

thanks @waldekmastykarz I've updated and it now works as expected

[sdacalor]

Hi,
I have been working on this error since january 11th. Also open an MSFT incident ticket.
The bug is present on 3.4.0 and 3.5.0 since january 11th.

It was on the provider Microsoft.BusinessAppPlatform API request.
After the update, I still have an error on both format JSON and ZIP :
unable to get local issuer certificate